Download - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS Implementation Guidance, Category 6: Intrusion ManagementA major concern for IM and Cloud Services is the inability of the IM SecaaS to get data from IaaS/PaaS/SaaScloud service providers. This information will be critical to a successful Incident Management program at theconsumer. Partnerships likely will be an important vehicle for this in the short term.3.2.3 Environmental and Security ConcernsAnything of a sensitive nature that should be filtered out before sending to IM SecaaS should be identified.Some of the major concerns surrounding IM SecaaS deal with the security of the actual IM SecaaS provider’sservice, as well as the data going into and out of it. Consumers should understand the technical specifics ofwhen and where the data they give to the IM SecaaS is unencrypted. Consumers should know what type ofaccess the IM SecaaS has to the data that is provided to them as well as who within the IM SecaaS provider hasaccess, or potential access, to the unencrypted data.There is a concern surrounding the separation of logs when in multi-tenancy environments at the IM SecaaS.How does the provider ensure proper segmentation?3.2.4 Technical Performance ConcernsHow does the IM SecaaS identify “dropped” or “missed” packets? Will the IM SecaaS be watching for sourcesthat drop off line or become unresponsive, or will it be the consumer? This should be addressed in the SLA.3.2.5 General ChallengesProliferation of SSL required by deployment in public clouds adds complexity or blocks visibility tonetwork-based IDS/IPSComplexity and immaturity of Intrusion Management for APIsLack of tools to manage instance-to-instance relationships3.2.6 Specific to Cloud ConsumersLack of virtual SPAN ports in public cloud providers for typical deployment of NIDS or NBALack of network-edge TAP interfaces for public cloud and virtual private cloud for typical deployment ofNIPSInability to utilize hypervisor (vSwitch/vNIC) introspectionLatency, resiliency and bandwidth concerns with proxying network traffic through virtual appliances or3rd party servicesPrivacy concerns of service-based securityShort lived instances (HIDS/HIPS logs can be lost)Performance limitations with network traffic in a shared environment3.2.7 Specific to Cloud Service Providers© Copyright 2012, Cloud Security Alliance. All rights reserved. 17